4

I've discovered that OpenSSH is capable of forwarding UNIX sockets like this:

ssh -R /var/run/program.sock:/var/run/program.sock

My question is whether this extends to abstract unix sockets too.

I've tried the following to no avail:

ssh -nNT -R @laminar:@laminar
ssh -nNT -R unix-abstract:laminar:unix-abstract:laminar

The program in question does support file-based unix sockets, but as it uses abstract sockets by default I'd like to avoid reconfiguring it to simplify matters if possible.

  • OpenSSH (client) version: OpenSSH_7.4p1 Raspbian-10+deb9u4, OpenSSL 1.0.2q 20 Nov 2018
  • OpenSSH (server) version: OpenSSH_7.6p1 Ubuntu-4ubuntu0.1, OpenSSL 1.0.2n 7 Dec 2017
  • 1
    socat supports abstract sockets. Perhaps you could use it as an intermediate. – meuh Feb 5 at 14:43
  • 1
    Not directly, but with socat you can. You can find same question here: stackoverflow.com/questions/49016346/… (and they are not "abstract" unix sockets, just unix sockets like you have UDP or TCP ones...) – Patrick Mevzek Feb 5 at 14:48
  • Good ideas, @meuh / @Patrick Mevzek! I think it's easier to reconfigure said program in this instance to use a file-based socket instead, but I'll keep socat in mind for the future :-) – starbeamrainbowlabs Feb 5 at 17:10
  • @PatrickMevzek if socat wasn't ASSuming that abstract unix socket addresses cannot contain NULs -- that would be great. YUCK – Uncle Billy Feb 5 at 18:23
1

No, that's not possible with the standard openssh-portable.

You can look for instance at the unix_listener() function here.

Maybe there are patches floating around, but I'm not going to answer with google search results ;-)

Adding such a thing should be technically easy, but who's going to deal with the "political" part, ie. convince the openssh developers to include the patch?

FWIW, such a patch should necessarily check the peer credentials of the clients connecting to the socket by default; openssh already includes the necessary compat code for that.

  • Thanks for the answer! I suspected as much. I'll look at refactoring to use a file-based unix socket instead then. I don't think I've got the skills to add support myself (let alone convince some developers I've never met to include my patch!), so perhaps someone take up the task eventually. – starbeamrainbowlabs Feb 5 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.